Zhouyi Divination

• Analyzed: May 11, 2026, 4:53 AM
• Findings: 1
• Version: 0.1.0
• Hash: e183881d091febe61629d7b8688441dc8e7fb2c2d4eaaacd4ed91a995a9cf945
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `SKILL.md` file contains direct instructions for the OpenClaw AI agent to perform file system operations. Specifically, it instructs the agent to read a local file (`/Users/taisenzhuang/.openclaw/workspace/zhouyi-divination/mingzhu.md`) containing sensitive user astrological data, and to automatically save generated reports to a user's iCloud directory (`~/Library/Mobile Documents/com~apple~CloudDocs/Documents/OpenClaw/报告/运势/`). While these actions align with the skill's stated purpose, direct file I/O instructions via prompt injection represent a risky capability and potential vulnerability surface for an AI agent, even without clear evidence of malicious intent like data exfiltration to external servers or backdoor installation.